Read this contract with the installed version
Use API authentication and request conventions first. Paths below are normalized; mount under the correct local Admin or Customer namespace. Every handler independently enforces current authorization, resource/account scope, feature/licence state and actual installed capability. A listed route is not a token-scope grant or native production acceptance. Read the operational procedure and fields before changing data. The newer source reference includes preparation/activation routes which earlier kits may not expose.
Every route in this family
| Method | Normalized path | Request and effect |
|---|---|---|
| GET | /v1/inventory |
Read authorized state/content; inspect observation time and pagination. |
| GET | /v1/server/snapshot |
Read authorized state/content; inspect observation time and pagination. |
| GET | /v1/server/catalogue |
Read authorized state/content; inspect observation time and pagination. |
| GET | /v1/plugins/library |
Read authorized state/content; inspect observation time and pagination. |
| GET | /v1/server/log-content |
Read authorized state/content; inspect observation time and pagination. |
| GET | /v1/server/support-bundle |
Read authorized state/content; inspect observation time and pagination. |
| POST | /v1/server/preview |
Create/read the exact server-generated impact and confirmation; preview is not apply. |
| POST | /v1/server/operations |
Explicit typed mutation; use the current revision/preview/CSRF or separately authorized token contract as applicable. |
| GET | /v1/security/status |
Read authorized state/content; inspect observation time and pagination. |
| GET | /v1/security/website-protection |
Read authorized state/content; inspect observation time and pagination. |
| GET | /v1/security/alerts |
Read authorized state/content; inspect observation time and pagination. |
| GET | /v1/security/login-activity |
Read authorized state/content; inspect observation time and pagination. |
| POST | /v1/security/preview |
Create/read the exact server-generated impact and confirmation; preview is not apply. |
| POST | /v1/security/operations |
Explicit typed mutation; use the current revision/preview/CSRF or separately authorized token contract as applicable. |
| GET | /v1/security/account |
Read authorized state/content; inspect observation time and pagination. |
| POST | /v1/security/account/revoke-sessions |
Explicit typed mutation; use the current revision/preview/CSRF or separately authorized token contract as applicable. |
Delivery, verification and errors
A returned operation or 202 means accepted work, not completed service change. Retain the operation ID and inspect events and actual resource state. Preserve one idempotency key for a reviewed ambiguous-delivery attempt. Current revision/ETag, exact impact preview and confirmation are separate protection mechanisms; do not guess or reuse stale values.
For 401, restore a valid local session/token. For 403, inspect the actual typed authorization/freshness/licence denial; generic denial is not automatically a password prompt. For 409, reload changed state or inspect the original operation. A capability/storage/agent 503 stays unavailable. Never place passwords, bearer tokens, private keys or recovery material in a URL. The complete request/response field reference distinguishes internal lifecycle models from public client input.